Ask Mary: Unauthorized WEB Debits

Dear Mary, How will the new ACH Rule requiring Originators to verify account numbers for WEB debits starting on March 19, 2021 affect unauthorized debit claims?

Let’s start with an example from this year’s Payment Systems Update! One of your account holders, Ann-Marie, claims a WEB debit from Owls Only online dating site was never authorized. Can you proceed per usual as the RDFI after the new ACH rule takes effect?

Beginning March 19, 2021, the ACH Rules make it explicit that “account validation” be part of a commercially reasonable system used to detect possible fraud attempts – that is, that the account to be used is a legitimate, open account to which ACH entries may be posted at the RDFI.

According to the Supplementing Fraud Detection Standards for WEB Debits FAQs, “Examples of methods to validate an account may include, but are not limited to, the use of a Prenotification Entry, ACH micro-transaction verification, use of a commercially available validation service provided by either an ODFI or a third-party and use of account validation capabilities or services enabled by APIs.”

This requirement only applies to the first use of an account number, or with subsequent changes to the account number, when used for WEB debit entries. So, if the account holder had signed up and entered their account number before March 19, no account validation is required.

So, what is the RDFI’s liability if the account was never verified or did not use a method to ensure ownership of the account? According to Subsection 3.1.2 of the ACH Rules, “An RDFI may rely solely on the account number contained in the Entry for purposes of posting the Entry to the Receiver’s account, regardless of whether the name of the Receiver matches the name associated with the account number in the Entry.”

And, if your account holder wants to return the item as Unauthorized, and your account holder completes and signs a Written Statement of Unauthorized Debit, you can and should still return that debit as R10 or R11 within 60 calendar days of the Settlement Date on the WEB debit. Also, remember, consumers receiving WEB debits may also be covered under Regulation E.

Learn more about the WEB debit requirements (and Ann-Marie’s debacle with Owls Only’s dating website) during Payment Systems Update! If you have any questions on how things will work this year, check out our FAQ article. You can also get a sneak peek of one of the hottest shows to be on the lookout for in series one, Payments Law and Order, by watching our trailer. Subscribe today!